Issue #3432868 by smustgrave, obsidian_, longwave, quietone, mstrelan, catch: Remove deprecated code from user module

Issue #3112298 by Spokje, mpdonadio, ravi.shankar, quietone, alexpott, smustgrave, immaculatexavier, ranjith_kumar_k_u, ankithashetty, mondrake, daffie, andypost, vladbo, JeroenT, pifagor, longwave, voleger: Replace REQUEST_TIME in classes with direct container access

Issue #3327294 by poker10, alexpott: Username enumeration via one time login route when logged in as another user

Issue #2921133 by quietone, VladimirAus, xjm, ankithashetty, longwave, Prem Suthar, smustgrave, benjifisher, AaronMcHale: Remove "Please" from the codebase

Issue #992540 by valthebald, ndobromirov, jec006, kid_icarus, rickmanelius, mr.baileys, pguillard, joseph.olstad, vijaycs85, paulocs, voleger, Matt V., aerozeppelin, ravi.shankar, quietone, Munavijayalakshmi, ranjith_kumar_k_u, evilehk, swentel, gaurav.kapoor, yogeshmpawar, klidifia, pradhumanjainOSL, louis-cuny, catch, Everett Zufelt, alexpott, cilefen, xjm, grendzy, cashwilliams, borisson_, lachezar.valchev, tstoeckler, Heine: Nothing clears the "5 failed login attempts" security message when a user resets their own password

Issue #3193759 by Bhanu951, _pratik_, lhridley, baliram.patil, mrconnerton, ameymudras, xjm, mfb, longwave, zviryatko, anmolgoyal74: Demote user log entries from "notice" to "info"

Issue #2828724 by Spokje, alexpott, ravi.shankar, Lal_, malcomio, ElusiveMind, smaz, yogeshmpawar, ridhimaabrol24, semiaddict, piggito, f.mazeikis, tvhung, tatarbj, ranjith_kumar_k_u, vijaycs85, baikho, Jelle_S, kleinmp, bbrala, Mike_info, David_Rothstein, pwolanin, cburschka: Username enumeration via one time login route

Issue #3168624 by DerekCresswell, ravi.shankar, BramDriesen, jonathanshaw, catch: Add 'user/edit' route

Issue #3222251 by bbrala, longwave: [November 8, 2021] Replace all isset constructs with the null coalescing operator

Issue #2473875 by znerol, alexpott, andypost, kim.pepper, amit.drupal, raman.b, martin107, joachim: Convert uses of $_SESSION to symfony session retrieved from the request

Issue #2193803 by wturrell, ridhimaabrol24, mglaman, Pavan B S, narendra.rajwar27, abhisekmazumdar, dpi, manish.upadhyay, pankaj.singh, paulocs, Charles Belov, quietone, catch, jim_at_miramontes, dawehner, goodboy: Anonymous users receive access denied when attempting to logout

Issue #3097445 by andypost, Berdir: Remove all @deprecated code in the User module except user:name token

Issue #1681832 by mcdruid, k_zoltan, dougvann, ZenDoodles, Cyberschorsch, kim.pepper, mohit1604, drumm, pdenooijer, eshta, mihai_brb, phiit, grwgreg, larowlan, amateescu, David_Rothstein, klausi, Damien Tournoud, coltrane, sun, aiypz, alippai: Password reset form has no flood protection

Issue #3053956 by alexpott, neeravbm, aleevas, voleger, Berdir: Deprecate \Drupal\Component\Utility\Crypt::hashEquals() in favour of PHP's builtin hash_equals()

Issue #2886622 by Berdir, martin107, Mile23, tim.plunkett, mikelutz, jonathan1055: Deprecate all EntityManager methods with E_USER_DEPRECATED

Issue #3018673 by nicksanta, dhirendra.mishra, jibran: Add support for RFC5785 change password well known resource

Issue #2787871 by alexpott, yogeshmpawar, Insasse, Prashant.c, catch, hass: Properly deprecate getUserName() and use getAccountName() instead

Issue #2746065 by Berdir, yogeshmpawar, hlykos, xeM8VfDh: Profile page's title/heading does not fulfill hook_user_format_name_alter

Issue #2855054 by alexpott, LoMo, wesleydv, Artusamak, gawaksh, xjm: User cancel link doesn't redirect to the homepage

Issue #2935256 by Jo Fitzgerald, voleger, kim.pepper, ibustos, Yogesh Pawar, catch, jibran: Remove all usages of drupal_get_message and drupal_set_message in modules

Revert "Issue #992540 by valthebald, ndobromirov, jec006, kid_icarus, rickmanelius, Matt V., aerozeppelin, Munavijayalakshmi, gaurav.kapoor, swentel, klidifia, Yogesh Pawar, Everett Zufelt, grendzy, cashwilliams, lachezar.valchev, alexpott, tstoeckler, catch, Heine: Nothing Clears the "5 Failed Login Attempts" Security message"

This reverts commit cade2c61.

Issue #992540 by valthebald, ndobromirov, jec006, kid_icarus, rickmanelius, Matt V., aerozeppelin, Munavijayalakshmi, gaurav.kapoor, swentel, klidifia, Yogesh Pawar, Everett Zufelt, grendzy, cashwilliams, lachezar.valchev, alexpott, tstoeckler, catch, Heine: Nothing Clears the "5 Failed Login Attempts" Security message

Issue #2776975 by joelpittet, dawehner, tim.plunkett, xjm, pfrenssen: March 3, 2017: Convert core to array syntax coding standards for Drupal 8.3.x RC phase

Issue #2515050 by alexpott, pwolanin, YesCT, David_Rothstein, prasad_gogate: A valid one-time login link may be leaked by the referer header to 3rd parties

Issue #2697909 by pguillard, himanshugautam, snehi, aburrows, jhodgdon: Fix "login (noun/adjective)" vs. "log in (verb)" in comments (and logout/log out)

Issue #2665992 by alexpott, klausi, heykarthikwithu, xjm, tstoeckler: @file is not required for classes, interfaces and traits

Issue #2400197 by pwolanin, fgm, znerol, neclimdul, mpdonadio, thekevinday, Fabianx: Harden the security where hash values are compared

Issue #2561685 by markpavlitski: Follow up to: One-time login link failure messages are misleading because they are not marked as errors

Issue #2570355 by Sutharsan, stefan.r, kgoel, josephdpurcell, joelpittet, justAChris, dawehner, pfrenssen, pwolanin, David_Rothstein, catch: Replace remaining !placeholder and @placeholder with :placeholder for URLs

Issue #2549791 by alexpott, Wim Leers: Remove SafeMarkup::xssFilter() and provide ability to define #markup escaping strategy and what tags to filter

Issue #2506195 by alexpott, joelpittet, xjm, David_Rothstein, Fabianx, pwolanin: Remove SafeMarkup::set() from Xss::filter()

Issue #2508627 by rvtraveller, pwolanin: Changing email address should invalidate one-time login links

Issue #2477641 by opdavies, pguillard, kaypro4, gyuhyon, edutrul, yoroy: One-time login link failure messages are misleading because they are not marked as errors

Issue #889772 by stefan.r, tuutti, opdavies, Sutharsan, joachim, das-peter, YesCT, Zerdiox, hussainweb, mgifford: following a password reset link while logged in leaves users unable to change their password

Issue #2461087 by Wim Leers, dawehner: Add 'no_cache' route option to mark a route's responses as uncacheable (was: Cron run response should not be cacheable)